fix: harden admin page cache headers

apps/web/src/layouts/Layout.astro

@@ -32,7 +32,12 @@ const theme = storedTheme === "light" || storedTheme === "dark" ? storedTheme :
 const siteUrl = import.meta.env.PUBLIC_SITE_URL || "https://rf4spotter.ru";
 const canonical = new URL(path, siteUrl).toString();
 const socialImage = new URL(image, siteUrl).toString();
-const preventIndexing = noindex || path === "/admin" || path.startsWith("/admin/");
+const isAdminPath = path === "/admin" || path.startsWith("/admin/");
+const preventIndexing = noindex || isAdminPath;
+if (isAdminPath) {
+  Astro.response.headers.set("Cache-Control", "private, no-store");
+  Astro.response.headers.set("X-Robots-Tag", "noindex, nofollow");
+}
 const websiteJsonLd = { "@type": "WebSite", name: "RF4 Spotter", url: siteUrl, inLanguage: "ru" };
 // A08: Skip structuredData on error pages (explicit errorPage prop)
 // Don't infer error from noindex alone — main page can have noindex on 422

deploy/probe-admin-auth.py

@@ -27,6 +27,10 @@ def probe(path, expected, authorization=None, method="GET", data=None):
         if path.startswith("/api/v1/admin/") and expected == 200:
             assert "no-store" in response.headers.get("Cache-Control", "")
             assert isinstance(json.load(response), dict)
+        if path == "/admin" or path.startswith("/admin/"):
+            if expected == 200:
+                assert "no-store" in response.headers.get("Cache-Control", "")
+                assert "noindex" in response.headers.get("X-Robots-Tag", "")
 
 
 probe("/admin", 401)